Burglarproof swiping method and system for mobile payment

Abstract

The invention provides a mobile payment-oriented unauthorized payment prevention method and system. The method comprises the following steps of: generating payment authorization data and a random code by using a payment terminal to calculate a first hash value so as to generate a first payment code; the collection terminal scans the first payment code to obtain a first hash value; the payment terminal regenerates a second payment code containing the payment authorization data and the random code; the collection terminal scans the second payment code to obtain a scanning result, and calculates a second hash value by using the scanning result; the collection terminal compares the second hash value with the first hash value to obtain a comparison result, and determines whether to continue collection according to the comparison result; and the convenience and flexibility of scanning payment are kept while fund unauthorized swiping is avoided.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of mobile payment, in particular to a mobile payment-oriented anti-skimming method and system. BACKGROUND

[0002] With the development of mobile Internet and the popularity of smart devices, mobile payment is used by more and more consumers and merchants due to its more convenient characteristics compared with traditional cash payment. Common mobile payment methods include payment code scanning payment, that is, the consumer shows the payment code to the merchant when paying, and the merchant scans the payment code shown by the consumer through the collection device to complete the collection, without providing password and other information, thus there is a security risk. One of the common situations at present is that when the consumer is ready to pay, in order to improve the payment efficiency, the payment code is generally prepared in advance, and the collection party is waited to scan the code. If the waiting time is slightly long, the payment code will have the risk of being stolen by an attacker (hereinafter referred to as an attacker) by taking a picture. The attacker uses the stolen payment code to pay for himself, that is, to steal the user's funds to pay for himself.

[0003] In order to reduce the probability of payment code being stolen, many existing payment platforms have adopted a mechanism to limit the effective time length of the payment code, but this time length cannot be too short. At present, the effective time length of most platforms is generally set in the range of several minutes, otherwise it will affect the payment efficiency. The time length of several minutes cannot effectively deal with the risk of payment code stealing. SUMMARY

[0004] The present application provides a mobile payment-oriented anti-skimming method and system, which aims to avoid fund theft while maintaining the convenience and flexibility of scanning payment.

[0005] In order to achieve the above purpose, the present application provides a mobile payment-oriented anti-skimming method, comprising:

[0006] Step 1, the payment terminal generates payment authorization data and a random code, and generates a first payment code according to a first hash value calculated based on the payment authorization data and the random code;

[0007] Step 2, the collection terminal scans the first payment code to obtain the first hash value;

[0008] Step 3, the payment terminal re-generates a second payment code containing the payment authorization data and the random code;

[0009] Step 4, the collection terminal scans the second payment code to obtain a scanning result, and calculates a second hash value using the scanning result;

[0010] Step 5, the collection terminal compares the second hash value with the first hash value to obtain a comparison result, and determines whether to continue collecting according to the comparison result.

[0011] Further, the first payment code is generated according to the first hash value calculated based on the payment authorization data and the random code, comprising:

[0012] selecting a standard hash function;

[0013] inputting the payment authorization data and the random code into the standard hash function to calculate a first hash value;

[0014] converting the first hash value into the first payment code.

[0015] Further, the standard hash function is a cryptographic hash function.

[0016] Further, the payment authorization data and the random code are inputted into the standard hash function to calculate, and the calculation expression is:

[0017]

[0018] wherein, represents the hash value, represents the hash function, represents the payment authorization data, represents the random code.

[0019] Further, the first payment code and the second payment code are both verification two-dimensional codes.

[0020] Further, the step 4 comprises:

[0021] scanning the second payment code by the collection terminal to obtain a scanning result;

[0022] converting the scanning result into the payment authorization data and the random code of the payment terminal;

[0023] inputting the converted payment authorization data and the random code into the standard hash function to calculate a second hash value.

[0024] Further, whether to continue the collection is determined according to the comparison result, comprising:

[0025] when the comparison result is consistent, completing the collection;

[0026] when the comparison result is inconsistent, feeding back the collection failure.

[0027] The application further provides a mobile payment-oriented anti-skimming system, comprising:

[0028] a generating module arranged in the payment terminal, used for generating the payment authorization data and the random code, and generating the first payment code according to the first hash value calculated based on the payment authorization data and the random code;

[0029] The generating module is arranged on the payment terminal and is used for regenerating a second payment code containing payment authorization data and a random code;

[0030] The scanning module is arranged on the payment terminal and is used for scanning the first payment code to obtain a first hash value and scanning the second payment code to obtain a scanning result;

[0031] The calculating module is arranged on the payment terminal and is used for calculating a second hash value by using the scanning result;

[0032] The comparing module is arranged on the payment terminal and is used for comparing the second hash value with the first hash value to obtain a comparison result and determining whether to continue payment according to the comparison result.

[0033] The above scheme of the present application has the following beneficial effects:

[0034] The present application uses the payment terminal to generate a first payment code containing a first hash value calculated by using payment authorization data and a random code; the payment terminal scans the first payment code to obtain the first hash value; the payment terminal regenerates a second payment code containing payment authorization data and a random code; the payment terminal scans the second payment code to obtain a scanning result and calculates a second hash value by using the scanning result; the payment terminal compares the second hash value with the first hash value to obtain a comparison result and determines whether to continue payment according to the comparison result; compared with the prior art, the first payment code generated by the payment terminal contains a random number, so that even if the first payment code is stolen, it cannot be used again in the next verification, and although there are two scanning processes in the use process, the second payment code scanned for the second time does not need to be prepared in advance, and the scanning time is extremely short, which does not affect the payment efficiency, avoids the fund being stolen, and maintains the convenience and flexibility of scanning payment.

[0035] Other beneficial effects of the present application will be described in detail in the subsequent specific embodiment part. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 The figure is a flowchart of an embodiment of the present application;

[0037] Figure 2 The figure is a structural diagram of an anti-theft system in an embodiment of the present application. DETAILED DESCRIPTION

[0038] To make the technical problems solved by the present application, technical solutions and advantages clearer, the following will be described in detail with reference to the drawings and specific embodiments. Obviously, the described embodiments are some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0039] In the description of the present application, it should be noted that the terms "first", "second", "third" are only for the purpose of description, and cannot be understood as indicating or implying relative importance.

[0040] In addition, the technical features involved in the different embodiments of the application described below can be combined with each other as long as they do not conflict with each other.

[0041] The present application aims at the existing problems, and provides a mobile payment-oriented anti-skimming method and system.

[0042] As Figure 1 shown, the embodiment of the present application provides a mobile payment-oriented anti-skimming method, comprising:

[0043] Step 1, the payment terminal generates payment authorization data and a random code, and generates a first payment code according to a first hash value calculated by the payment authorization data and the random code;

[0044] Step 2, the payment terminal scans the first payment code to obtain the first hash value;

[0045] Step 3, the payment terminal re-generates a second payment code containing the payment authorization data and the random code;

[0046] Step 4, the payment terminal scans the second payment code to obtain a scanning result, and calculates a second hash value by using the scanning result;

[0047] Step 5, the payment terminal compares the second hash value with the first hash value to obtain a comparison result, and determines whether to continue collecting money according to the comparison result.

[0048] Specifically, the first hash value calculated according to the payment authorization data and the random code generates the first payment code, comprising:

[0049] selecting a standard hash function;

[0050] inputting the payment authorization data and the random code into the standard hash function for calculation to obtain the first hash value;

[0051] converting the first hash value into the first payment code.

[0052] Most preferably, the standard hash function is a cryptographic hash function.

[0053] In the embodiment of the present application, the selected standard hash function can be any mature cryptographic hash function, including but not limited to MD5, SHA-256 and other cryptographic hash functions.

[0054] In the embodiment of the present application, since the selected standard hash function has the characteristics of one-way irreversibility, the possibility of fund misuse can be avoided from one aspect, and the security of payment transaction is ensured to a certain extent.

[0055] Specifically, the payment authorization data and the random code are input into the standard hash function for calculation, and the calculation expression is:

[0056]

[0057] wherein, represents a hash value, represents a hash function, represents payment authorization data, represents a random code.

[0058] Specifically, the first payment code and the second payment code are both verification two-dimensional codes.

[0059] In the embodiment of the present application, since the first payment code is a verification two-dimensional code and is not a regular payment code, and in view of the characteristics of the hash function being one-way irreversible, the second payment code cannot be derived from the first payment code, therefore, even if the first payment code is stolen or misused, it will not affect the payment security, thereby effectively solving the payment security problem caused by the two-dimensional payment code being stolen.

[0060] Specifically, step 4 includes:

[0061] The second payment code is scanned by the payment terminal to obtain a scanning result;

[0062] The scanning result is converted into payment authorization data and a random code of the payment terminal;

[0063] The payment authorization data and the random code obtained by the conversion are input into the standard hash function for calculation to obtain a second hash value.

[0064] Specifically, whether to continue the payment is determined according to the comparison result, including:

[0065] When the comparison result is consistent, the payment is completed;

[0066] When the comparison result is inconsistent, the payment failure is fed back.

[0067] The embodiment of the present application further describes the provided method in combination with specific examples:

[0068] First, the payment terminal is defined as a smart device of the user, such as a smart phone or a smart watch, and the payment terminal is defined as a merchant cash register system, which includes a scanning gun or a code scanner;

[0069] When preparing to pay, the smart phone or the smart watch generates specific payment authorization data The payment authorization data includes key information such as the merchant ID, transaction amount, and payment account for this payment, and also generates a random code. For example, "89237456";

[0070] Then select a commonly used standard hash function in the payment application of your smartphone or smartwatch. Payment authorization data With random code After merging, the hash value is calculated using a standard hash function to obtain the first hash value. We can assume the first hash value The hash value is "abcdef1234567890", and the first hash value is... Convert to First Payment Code And show the barcode scanner or barcode scanner to the merchant;

[0071] During the payment process, the merchant's barcode scanner or barcode reader scans the first payment code. Then the first payment code Convert to first hash value At this point, the user clicks the "Confirm Payment" button on their smartphone or smartwatch. The smartphone or smartwatch then combines the payment authorization data and the random code to generate a second payment code. And show the barcode scanner or barcode scanner to the merchant;

[0072] The merchant's barcode scanner or barcode scanner scans the second payment code. The scan results are obtained, and the merchant's POS system then parses the scan results to obtain payment authorization information. and random code and payment authorization information and random code Enter the same standard hash function selected in the payment application on your smartphone or smartwatch. The calculation yields the second hash value. Assuming the second hash value The value is "abcdef1234567890";

[0073] The merchant's POS system compares the second hash value. With the first hash value Both hashes were found to be "abcdef1234567890", indicating a successful verification. The merchant's POS system then sends a payment instruction to the payment platform, completing the payment process and resulting in a successful payment. (First hash value) Second hash value If the two are inconsistent, the verification fails, the merchant's cash register system feeds back a payment failure reminder, and the operation needs to be re-performed.

[0074] The payment terminal generates payment authorization data and a random code, calculates a first hash value based on the payment authorization data and the random code, and generates a first payment code based on the first hash value; the collection terminal scans the first payment code and obtains the first hash value; the payment terminal re-generates a second payment code containing the payment authorization data and the random code; the collection terminal scans the second payment code, obtains a scanning result, and calculates a second hash value based on the scanning result; the collection terminal compares the second hash value with the first hash value, obtains a comparison result, and determines whether to continue the collection based on the comparison result. Compared with the prior art, the first payment code generated by the payment terminal in the embodiment of the application contains a random number. Even if the first payment code is stolen, it cannot be used again in the next verification. Although there are two code scanning processes in the use process, the second payment code scanned in the second scanning process does not need to be prepared in advance, and the scanning time is extremely short, which does not affect the payment efficiency. The convenience and flexibility of scanning payment are maintained while avoiding fund theft.

[0075] As shown in Figure 2 The embodiment of the application also provides a mobile payment-oriented anti-theft system, which comprises:

[0076] A generating module is arranged in the payment terminal and used for generating payment authorization data and a random code, and generating a first payment code based on a first hash value calculated based on the payment authorization data and the random code;

[0077] A generating module is arranged in the payment terminal and used for re-generating a second payment code containing the payment authorization data and the random code;

[0078] A scanning module is arranged in the collection terminal and used for scanning the first payment code to obtain the first hash value and scanning the second payment code to obtain a scanning result;

[0079] A calculating module is arranged in the collection terminal and used for calculating a second hash value based on the scanning result;

[0080] A comparing module is arranged in the collection terminal and used for comparing the second hash value with the first hash value, obtaining a comparison result, and determining whether to continue the collection based on the comparison result.

[0081] It should be noted that the scanning module is a scanning gun or a code scanner in the cash register system.

[0082] The above is the preferred embodiment of the application. It should be noted that, for those skilled in the art, without departing from the principles of the application, a number of improvements and refinements can be made, which should also be considered within the scope of protection of the application.

Claims

1. A mobile payment-oriented fraud prevention method, characterized by, The method comprises: Step 1, a payment terminal generates payment authorization data and a random code, and generates a first payment code according to a first hash value calculated based on the payment authorization data and the random code; Step 2, a receiving terminal scans the first payment code to obtain the first hash value; Step 3, the payment terminal re-generates a second payment code containing the payment authorization data and the random code; Step 4, the receiving terminal scans the second payment code to obtain a scanning result, and calculates a second hash value based on the scanning result; Step 5, the receiving terminal compares the second hash value with the first hash value to obtain a comparison result, and determines whether to continue receiving payment according to the comparison result.

2. The mobile payment oriented fraud prevention method according to claim 1, characterized in that, The method of generating a first payment code according to a first hash value calculated based on the payment authorization data and the random code comprises: selecting a standard hash function; inputting the payment authorization data and the random code into the standard hash function to calculate the first hash value; converting the first hash value into the first payment code.

3. The mobile payment oriented fraud prevention method according to claim 2, wherein, The standard hash function is a cryptographic hash function.

4. The mobile payment oriented fraud prevention method according to claim 3, characterized in that, The calculation expression of inputting the payment authorization data and the random code into the standard hash function is: ； wherein, represents a hash value, represents a hash function, represents payment authorization data, represents a random code.

5. The mobile payment oriented fraud prevention method according to claim 1, wherein, The first payment code and the second payment code are both verification two-dimensional codes.

6. The mobile payment oriented fraud prevention method according to claim 4, wherein, The step 4 comprises: the receiving terminal scans the second payment code to obtain a scanning result; converting the scanning result into payment authorization data and a random code of the payment terminal; inputting the converted payment authorization data and random code into the standard hash function to calculate the second hash value.

7. The mobile payment oriented fraud prevention method according to claim 6, characterized in that, The method of determining whether to continue receiving payment according to the comparison result comprises: when the comparison result is consistent, completing the receiving payment; when the comparison result is inconsistent, feeding back a receiving payment failure.

8. A mobile payment oriented fraud prevention system, characterized by, The method comprises: a generating module arranged on a payment terminal, used for generating payment authorization data and a random code, and generating a first payment code according to a first hash value calculated based on the payment authorization data and the random code; a generating module arranged on the payment terminal, used for re-generating a second payment code containing the payment authorization data and the random code; a scanning module arranged on a receiving terminal, used for scanning the first payment code to obtain the first hash value, and used for scanning the second payment code to obtain a scanning result; a calculating module arranged on the receiving terminal, used for calculating a second hash value based on the scanning result; a comparing module arranged on the receiving terminal, used for comparing the second hash value with the first hash value to obtain a comparison result, and used for determining whether to continue receiving payment according to the comparison result.

Images